browser-to-api
Pass
Audited by Gen Agent Trust Hub on Jul 19, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill processes browser trace data which may contain sensitive information such as authorization headers, cookies, and personal identifiers. However, the skill implements a comprehensive redaction library (
scripts/lib/redact.mjs) specifically designed to scrub common secrets (tokens, keys, passwords, JWTs) and PII (emails, phone numbers) from all generated output files, minimizing the risk of accidental exposure. - [INDIRECT_PROMPT_INJECTION]: As the skill ingests untrusted data from browser traces to generate a visual HTML report, it employs proper HTML entity escaping (
escHtmlinscripts/emit.mjs) to prevent stored cross-site scripting (XSS) or other injection attacks when the user views the generated report. - [EXTERNAL_DOWNLOADS]: The documentation references external tools like
jqand repositories like Swagger UI for extended functionality. These are well-known, trusted resources, and the skill itself does not perform any automated or hidden network downloads during its operation.
Audit Metadata